Cloudflare (API token)
Give the Sazabi agent access to Cloudflare Workers, DNS, zones, and more through the hosted Cloudflare API MCP server, authenticated with an API token you mint yourself.
All Cloudflare integration capabilities
About
This is an MCP connector that gives the Sazabi agent tools from Cloudflare's hosted unified API MCP server (mcp.cloudflare.com), authenticated with a Cloudflare API token instead of OAuth. You create the token in the Cloudflare dashboard scoped to exactly the permissions you want the agent to have, then provide it to Sazabi. Sazabi sends it as an Authorization: Bearer <token> header and validates it against Cloudflare's verify endpoint before completing the connection.
If you prefer OAuth instead of an API token, see Cloudflare OAuth connector.
What the agent can do:
- Query Workers observability logs and analytics
- Inspect Workers bindings (D1, R2, KV) and account resources
- Review Workers Builds history and status
- Browse Cloudflare Radar internet traffic insights
Prerequisites
- An active Cloudflare account
- A Cloudflare API token scoped to the products you want the agent to access (tokens with Client IP Address Filtering enabled are not supported)
Set up in the dashboard
Configure connectors in the dashboard under Settings > MCP connectors.
Open the connector
Find Cloudflare (API token) in Settings > MCP connectors.
Add your key
In the Cloudflare dashboard, go to My Profile > API Tokens > Create Token, then Create Custom Token. Under Permissions, add read access for the products you want the agent to use — for example Account > Workers Observability > Read, Zone > DNS > Read, and Account > Account Settings > Read — then copy the generated cfut_... token.
Paste the token into Sazabi. Sazabi stores it securely and sends it as the Authorization header (Authorization: Bearer <token>) to Cloudflare's hosted MCP endpoint at https://mcp.cloudflare.com/mcp.
Set up with the CLI
Cloudflare authenticates with a Cloudflare API token. With the Sazabi CLI installed and authenticated (see sazabi mcp-connectors reference), connect it in one command, passing the credential as a header:
sazabi mcp-connectors connect cloudflare-api-token --header "Authorization=Bearer <api-token>"The CLI connects to the MCP server at once and prints the connection with the tools it discovered; a credential the server rejects is reported, and the connection is left needing attention. Use NAME=@<file> to read a value from a file, or --header-file <file.json> for a JSON object of header names and values. To rotate the stored credentials later, use sazabi mcp-connectors update-credentials <connection-id>; find the connection ID with sazabi mcp-connectors list.
Verify
Open the connector's connection page under Settings > MCP connectors and confirm Sazabi lists the tools it discovered. Then, in a thread, ask the agent to use one of those tools and confirm it runs. If no tools appear, confirm the token is correct and has the expected permissions.
Troubleshooting
No tools discovered — Check that the API token is valid and scoped to the products you want. Tokens with Client IP Address Filtering enabled are not supported by the hosted MCP server.
Connection shows needs attention — The token may have been revoked or expired; create a new token and reconnect from Settings > MCP connectors.